CVE-2026-102250 Details
Description
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
A vulnerability exists in Schneider Electric's SAGE RTU products, including models 1410, 1430, 1450, 2400, 3030 Magnum, and 4400, all versions prior to C3414-500-S02L0. This vulnerability, categorized as CWE-345, allows an authorized admin user to upload modified firmware during a firmware update, potentially leading to unauthorized control over the device.
Users can upgrade to version C3414-500-S02L0 of the SAGE RTU products, which includes a fix for this vulnerability. After upgrading, it is recommended to verify the firmware version on the CPU configuration page. For assistance with the patching process, contact Schneider Electric's Customer Care Center.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Schneider Electric Sage RTU 1410 | < C3414-500-S02L0 |
CPE
Remediation
| |
| Schneider Electric Sage RTU 1430 | < C3414-500-S02L0 |
CPE
Remediation
| |
| Schneider Electric Sage RTU 1450 | < C3414-500-S02L0 |
CPE
Remediation
| |
| Schneider Electric Sage RTU 2400 | < C3414-500-S02L0 |
CPE
Remediation
| |
| Schneider Electric Sage RTU 3030 Magnum | < C3414-500-S02L0 |
CPE
Remediation
| |
| Schneider Electric Sage RTU 4400 | < C3414-500-S02L0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |